CVE-2026-54250

Undergoing Analysis Undergoing Analysis - In Progress

Path Traversal in K3s etcd Snapshot Decompression

Publication date: 2026-06-25

Last updated on: 2026-06-26

Assigner: GitHub, Inc.

Description

K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names can be written to arbitrary locations on the filesystem when an administrator restores the archive as a compressed etcd snapshot. This vulnerability is fixed in 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-06-26

Generated

2026-07-16

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-54250

EUVD

EUVD-2026-39512

Affected Vendors & Products

Vendor	Product	Version / Range
rancher	k3s	1.35.3+k3s1
rancher	k3s	1.34.6+k3s1
rancher	k3s	v1.33.10+k3s1
rancher	k3s	to 1.35.3+k3s1 (exc)
rancher	k3s	to 1.34.6+k3s1 (exc)
rancher	k3s	to v1.33.10+k3s1 (exc)
k3s	1.35.2+k3s1	to 1.35.3+k3s1 (exc)
k3s	1.34.5+k3s1	to 1.34.6+k3s1 (exc)
k3s	1.33.9+k3s1	to 1.33.10+k3s1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in the K3s Kubernetes distribution's etcd snapshot decompression functionality. Specifically, when an administrator restores a compressed etcd snapshot, zip files containing archive members with maliciously crafted names can cause files to be written to arbitrary locations on the filesystem.

Impact Analysis

The vulnerability can allow an attacker with the ability to provide a malicious etcd snapshot archive to write files to arbitrary locations on the filesystem during the restore process. This can lead to integrity and availability impacts, such as overwriting critical files or injecting malicious files, potentially compromising the system.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade K3s to one of the fixed versions: 1.35.3+k3s1, 1.34.6+k3s1, or v1.33.10+k3s1.

Compliance Impact

The provided information does not specify how the path traversal vulnerability in K3s's etcd snapshot decompression functionality directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability involves path traversal in K3s's etcd snapshot decompression functionality, which can lead to arbitrary file writes when restoring compressed etcd snapshots.

To detect if your system is vulnerable, first verify the K3s version installed. Versions prior to 1.35.3+k3s1, 1.34.6+k3s1, and 1.33.10+k3s1 are affected.

Check the K3s version with the command: `k3s --version` or `k3s -v`.
Inspect etcd snapshot files for suspicious archive members with path traversal patterns such as '../../' in their filenames.
Manually extract the snapshot archive using unzip or tar commands and look for files with maliciously crafted paths before restoring.
Example command to list contents of a snapshot archive and check for path traversal: `unzip -l snapshot.zip | grep '\.\./'`
Alternatively, extract the archive safely and inspect filenames: `unzip -d /tmp/snapshot_extracted snapshot.zip` and then `find /tmp/snapshot_extracted -name '*..*'`

If malicious paths are found, the snapshot should not be restored without remediation.

Hi! I’m here to help you understand CVE-2026-54250. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70